The news
Workday (WDAY) has signed a definitive agreement to acquire C1.ai, the identity company also known as ConductorOne, to control what both employees and AI agents can access inside a business. Workday announced the deal on October 13 at its Workday Rising 2026 conference in Las Vegas, and searches for "c1 ai" rose after the news.
Workday did not disclose the price. The company said it expects the deal to close in the fourth quarter of its fiscal year 2027, which ends January 31, 2027, subject to customary closing conditions. A GuruFocus report on Workday's filing said Workday will acquire all outstanding capital stock of ConductorOne, Inc. and dated the announcement October 12.
According to the announcement, C1.ai connects to systems such as email, customer relationship management (CRM) software, code repositories, finance systems and cloud infrastructure. It grants each person and each agent access when they need it and removes it when they no longer do. The company describes its product as providing scoped access, enforced policies, human approval and a record of every action.
Workday plans to use the technology to extend its Agent System of Record, a product that already registers and manages AI agents, so it also governs what those agents are allowed to touch. Gerrit Kazmaier, Workday's president of product and technology, said in the release that companies now run on a combined workforce of people and AI agents. Alex Bovee, C1.ai's CEO and co-founder, argued that enterprises cannot secure AI using yesterday's IT tickets.
The release cites C1.ai research finding that 95% of large U.S. companies already run autonomous agents, and Deloitte research finding that only 21% report a mature way to govern them. BofA Securities and Orrick advised Workday; Qatalyst and Ashurst Perkins Coie advised C1.ai.
The numbers
- Deal value
- Not disclosed
- Expected close
- Workday fiscal Q4 2027 (ends Jan. 31, 2027)
- Large U.S. companies running autonomous agents (C1.ai research)
- 95%
- Companies with mature agent governance (Deloitte)
- 21%
Why CEOs should care
For CIOs and CISOs, the deal signals that the vendors running HR and finance want to own the question of who, or what, can access company systems. Identity governance has typically been bought as a separate security product. If Workday folds agent access controls into the platform that already holds employee records, buyers should ask how it will work alongside existing identity tools, and whether policies will have to be managed in two places.
For security leaders, the gap in the release is the useful part: by Deloitte's count, only 21% of companies report a mature way to govern agents. Teams should inventory which AI agents already hold credentials to email, code repositories and finance systems, whether access is time-limited, and whether every agent action is logged. Those are the controls C1.ai says it provides, and a reasonable checklist for any vendor.
For CFOs and procurement teams, an undisclosed price and a close expected by January 31, 2027 mean pricing and packaging are still unknown. Existing C1.ai customers should ask about contract continuity and roadmap, and Workday customers should ask whether agent governance will be bundled or sold as an add-on.
The bigger picture
Enterprise software vendors are racing to become the system of record for AI agents, not just for people. Workday describes itself as the agentic platform for HR, finance and IT, and buying an identity layer moves it closer to security budgets. The move also puts it closer to established identity governance vendors as AI agents multiply inside companies.
What’s next
Workday expects the acquisition to close by January 31, 2027, subject to customary conditions, and GuruFocus noted the filing gives no assurance it will close as planned. Watch for pricing, integration timelines with the Agent System of Record, and how Workday treats C1.ai customers who do not use Workday.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
